Changeset 175965 in webkit

Timestamp:

Nov 11, 2014, 11:38:37 AM (12 years ago)

Author:

dbates@webkit.org

Message:

[Frame Flattening] ASSERT(transaction->view == &view()) fails in RenderBlock::removeFromUpdateScrollInfoAfterLayoutTransaction()
​https://bugs.webkit.org/show_bug.cgi?id=138615
<rdar://problem/18928487>

Reviewed by David Hyatt.

Source/WebCore:

Fixes an issue where we always expected that the RenderView associated with the RenderBlock called in
RenderBlock::removeFromUpdateScrollInfoAfterLayoutTransaction() is the same as the RenderView associated with
the top transaction in the UpdateScrollInfoAfterLayoutTransaction stack regardless of frame flattening. This
expectation is only true when frame flattening is disabled.

Test: fast/frames/flattening/iframe-flattening-inside-flexbox-with-delayed-scroll-update.html

• rendering/RenderBlock.cpp:

(WebCore::RenderBlock::removeFromUpdateScrollInfoAfterLayoutTransaction):

LayoutTests:

Add a test that causes an assertion failure in affected builds.

• fast/frames/flattening/iframe-flattening-inside-flexbox-with-delayed-scroll-update-expected.txt: Added.
• fast/frames/flattening/iframe-flattening-inside-flexbox-with-delayed-scroll-update.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/frames/flattening/iframe-flattening-inside-flexbox-with-delayed-scroll-update-expected.txt (added)
• LayoutTests/fast/frames/flattening/iframe-flattening-inside-flexbox-with-delayed-scroll-update.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/rendering/RenderBlock.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2014-11-11  Daniel Bates  <dabates@apple.com>
+
+        [Frame Flattening] ASSERT(transaction->view == &view()) fails in RenderBlock::removeFromUpdateScrollInfoAfterLayoutTransaction()
+        https://bugs.webkit.org/show_bug.cgi?id=138615
+        <rdar://problem/18928487>
+
+        Reviewed by David Hyatt.
+
+        Add a test that causes an assertion failure in affected builds.
+
+        * fast/frames/flattening/iframe-flattening-inside-flexbox-with-delayed-scroll-update-expected.txt: Added.
+        * fast/frames/flattening/iframe-flattening-inside-flexbox-with-delayed-scroll-update.html: Added.
+
 2014-11-11  Tibor Meszaros  <tmeszaros.u-szeged@partner.samsung.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2014-11-11  Daniel Bates  <dabates@apple.com>
+
+        [Frame Flattening] ASSERT(transaction->view == &view()) fails in RenderBlock::removeFromUpdateScrollInfoAfterLayoutTransaction()
+        https://bugs.webkit.org/show_bug.cgi?id=138615
+        <rdar://problem/18928487>
+
+        Reviewed by David Hyatt.
+
+        Fixes an issue where we always expected that the RenderView associated with the RenderBlock called in
+        RenderBlock::removeFromUpdateScrollInfoAfterLayoutTransaction() is the same as the RenderView associated with
+        the top transaction in the UpdateScrollInfoAfterLayoutTransaction stack regardless of frame flattening. This
+        expectation is only true when frame flattening is disabled.
+
+        Test: fast/frames/flattening/iframe-flattening-inside-flexbox-with-delayed-scroll-update.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::removeFromUpdateScrollInfoAfterLayoutTransaction):
+
 2014-11-11  Tim Horton  <timothy_horton@apple.com>
 

trunk/Source/WebCore/rendering/RenderBlock.cpp

@@ -897 +897 @@
         UpdateScrollInfoAfterLayoutTransaction* transaction = currentUpdateScrollInfoAfterLayoutTransaction();
         ASSERT(transaction);
-        ASSERT(transaction->view == &view());
-        transaction->blocks.remove(this);
+        if (transaction->view == &view())
+            transaction->blocks.remove(this);
     }
 }